Privacy Policy

Information we collect

• Account and contact information: your name, email, shop name, business details, access requests, account role, and messages you send us. Account authentication records include password hashes and password-reset records.
• Shop information: inventory, quantities, prices, product identifiers, conditions, spreadsheet imports, images you submit, and menu settings.
• Connected services: when you authorize a marketplace or point-of-sale connection, we receive the account identifiers, authorization tokens, listings, inventory, and order information available through the permissions you approve. For inventory synchronization, relevant records include order and line identifiers, product identifiers, quantities, timestamps, and synchronization results. Availability depends on which integrations are enabled.
• Subscription information: plan, billing status, and payment-provider customer and subscription identifiers. Stripe processes payment details; Cardex does not store your full payment-card number.
• Shipping information: for connected order fulfillment, recipient names, shipping addresses, available contact details, purchased items, package weights and dimensions, ship-from addresses, shipping rates, labels, carrier identifiers, tracking numbers and fulfillment results. Shipping credentials and stored recipient details are encrypted.
• Technical and activity information: IP addresses, browser and device information, request and error logs, account actions, and timestamps used to operate and protect the service.
• Workstation preferences: a random browser profile identifier, workstation name, selected print formats, and the printer and scanner names and preferences you enter. Cardex does not read Bluetooth hardware identifiers.

How we use information

We use information to manage access and accounts; provide inventory, catalog, import, scanning, and live menu functions; synchronize authorized listings and stock; process subscriptions; respond to requests; troubleshoot problems; prevent fraud and unauthorized access; and meet applicable legal obligations. We also use operational information to understand and improve how the service works.

If you connect eBay, Shopify, or another provider, we use that provider’s data to perform the features you authorize, such as identifying the connected seller, reading listings and sales, updating available stock, and preventing duplicate sale processing. Connecting an account does not authorize unrelated marketing uses of its data.

If you enable shipping, Cardex uses order and address information to prepare packing slips, request rates, purchase labels you confirm, and send tracking and fulfillment information back to the originating marketplace.

If you pair the TCGplayer browser bridge, the extension uses the seller portal already signed in on your computer to read order and inventory details for your shop. Cardex receives the imported order, recipient and listing details and the results of approved stock and shipping updates. The bridge stores a Cardex pairing token in Chrome and does not collect your TCGplayer password or session cookies.

When information is shared

Information is available to authorized users of your shop and to Cardex personnel who need it to operate, support, or secure the service. We use service providers for hosting and databases (including Amazon Web Services), payments (Stripe), and transactional email (Resend). If you use image identification, submitted images are sent to Ximilar for that feature. Connected marketplaces and POS providers receive the requests and information needed to carry out your authorized connection.

Information may also be disclosed when required by law, to protect people and the service, or as part of a business transaction such as a merger or acquisition, subject to applicable protections. Cardex does not sell personal information or share it for cross-context behavioral advertising.

When you request shipping rates or labels, EasyPost and the selected carrier receive the recipient, sender, package and shipment details needed to provide those services. Those providers process information under their own policies and service terms.

Products, prices, availability, images, and other details you choose to publish on a shop’s public menu are visible to visitors. Avoid entering private customer information in public product names, descriptions, images, or other published fields.

Cookies and browser storage

Cardex uses cookies and browser storage for functions such as keeping you signed in, securing account connections, and remembering interface preferences. Hosting and connected services may process technical information under their own policies. You can manage cookies through your browser; blocking necessary cookies may prevent sign-in or connected-account features from working.

Retention and security

We retain information for as long as needed to provide the service, maintain account and transaction records, investigate problems, protect the service, and meet legal obligations. Retention depends on the information’s purpose, account status, and applicable requirements. Backup copies may remain until their normal replacement or expiration, and limited records may be retained where necessary for legal, security, or accounting purposes.

We use safeguards including access controls, encrypted connections, password hashing, and encryption of stored marketplace credentials. No system can guarantee complete security. Keep your login credentials private and grant shop access only to people you trust.

Our infrastructure includes services in the United States. Information may be processed in the United States or other countries where our service providers operate.

Your choices and requests

You can ask to access, correct, export, or delete your personal information, or to disconnect a marketplace, by emailing access@cardexapp.io. Identify your Cardex account and shop, and describe the request. We may verify your identity and authority before acting. Please do not include passwords, API keys, or payment-card numbers.

You can also revoke Cardex’s authorization in the connected provider’s account settings. Revoking access stops future authorized API access; it does not automatically erase information already retained in Cardex. Contact us to request deletion of stored connection data. Some records may need to be retained for the purposes described above.

Depending on where you live and which laws apply, you may have additional rights, including to object to or restrict processing, withdraw consent, or complain to a privacy regulator. We handle requests subject to applicable law and do not discriminate for exercising applicable privacy rights.

When a shop uses Cardex to manage information about its own customers, the shop determines how that information is used for its business. Contact that shop first about its customer records; Cardex can assist the shop with requests relating to the information it manages through our service.

Children and third-party services

Cardex’s account and shop-management services are intended for business operators and are not directed to children under 13. If you believe a child has provided personal information to Cardex, contact us so we can investigate and address it.

Other websites, marketplaces, and payment or service providers have their own privacy policies. Review those policies when you use their services.

Changes and contact

We may update this policy as the service or our practices change. We will publish the updated policy here with a revised effective date and provide additional notice when required by applicable law.

For privacy questions, account-data requests, or marketplace-data deletion requests, email access@cardexapp.io.